My application is currently undergoing security review (AppExchange submitting) and has been reported with the 'Insecure Storage of Sensitive Data' issue related to the following line of code.
private static final String YOUTUBE_DATA_API_KEY = 'xxxxxxxx';
How do we store the API key (YOUTUBE_DATA_API_KEY) to pass 'Insecure Storage of Sensitive Data'?
p/s: My desired solution is that users don't have to set up their API keys but can use ours.
If this API key never changes, the best way to package it is to use protected custom metadata. Then, you can add the custom metadata record with your key to your package.
If customers can set the key, create a custom LWC where customers can enter the key. Store the key in a protected hierarchical custom setting at the org level. You could use custom metadata as well but that's much more complicated than using a custom setting. In case uou want to go for custom metadata, you need to use Apex Metadata, but a custom setting you can simple save using DML.
Just so you know, the LWC shouldn't show any saved values. Even obfuscating the key through a password field won't pass security review. Your LWC should check if the key is valid, store the key, and then let the user know the key has been successfully stored but not show it 'back' to the user.
In any case, the essence is that the key should be stored in a protected way and not in the open.
to store the API key securely, you can consider storing it in custom setting with protected mode. Since custom settings are also like objects, you can query that custom setting in your Apex code with the field that API key is stored and use it in the necessary place.
